From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FF61C433E0 for ; Mon, 10 Aug 2020 15:29:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6A08422D07 for ; Mon, 10 Aug 2020 15:29:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597073384; bh=p4V3sOMcIcLg6bOq8lNuDQ3c0vE6GzxHlypxaeyenpk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=N4RGOACno3LT7aKUis76px5Ws1q+4mQXV8G8XEHfNTU+9kgNPlSMLKer8swrOYLxU M1J0zXUn50+Z95n/KgieMtzmb65uvydry3CevyqC0nPHe3sEIShIaKVLd54O58Y7Yx +TLdWqcLv3qTqIEMU3UB1Kh5m/Hj1+NtWyVNePAA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728998AbgHJP3n (ORCPT ); Mon, 10 Aug 2020 11:29:43 -0400 Received: from mail.kernel.org ([198.145.29.99]:35954 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728959AbgHJP3b (ORCPT ); Mon, 10 Aug 2020 11:29:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E12D022D07; Mon, 10 Aug 2020 15:29:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597073370; bh=p4V3sOMcIcLg6bOq8lNuDQ3c0vE6GzxHlypxaeyenpk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JeCvXyjWstIb+Ig3fWKBHEVYfLL9qsUrg1q91AUOpTElFVN6DIebanmjtsUdaXYqh a9UsGUuxPKD/XM4ulbrZGOiBE7Oxpco5uUIr8wj4zG+hHwE3MgSYtlVvOi7OEQ4b2t pISwb/VIALlizBgPHqbHX6GoSXNCryDEulZ54UTE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , stable Subject: [PATCH 4.19 14/48] mtd: properly check all write ioctls for permissions Date: Mon, 10 Aug 2020 17:21:36 +0200 Message-Id: <20200810151804.911709325@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200810151804.199494191@linuxfoundation.org> References: <20200810151804.199494191@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman commit f7e6b19bc76471ba03725fe58e0c218a3d6266c3 upstream. When doing a "write" ioctl call, properly check that we have permissions to do so before copying anything from userspace or anything else so we can "fail fast". This includes also covering the MEMWRITE ioctl which previously missed checking for this. Cc: Miquel Raynal Cc: Richard Weinberger Cc: Vignesh Raghavendra Cc: stable Signed-off-by: Greg Kroah-Hartman [rw: Fixed locking issue] Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- drivers/mtd/mtdchar.c | 56 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 47 insertions(+), 9 deletions(-) --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -368,9 +368,6 @@ static int mtdchar_writeoob(struct file uint32_t retlen; int ret = 0; - if (!(file->f_mode & FMODE_WRITE)) - return -EPERM; - if (length > 4096) return -EINVAL; @@ -655,6 +652,48 @@ static int mtdchar_ioctl(struct file *fi pr_debug("MTD_ioctl\n"); + /* + * Check the file mode to require "dangerous" commands to have write + * permissions. + */ + switch (cmd) { + /* "safe" commands */ + case MEMGETREGIONCOUNT: + case MEMGETREGIONINFO: + case MEMGETINFO: + case MEMREADOOB: + case MEMREADOOB64: + case MEMLOCK: + case MEMUNLOCK: + case MEMISLOCKED: + case MEMGETOOBSEL: + case MEMGETBADBLOCK: + case MEMSETBADBLOCK: + case OTPSELECT: + case OTPGETREGIONCOUNT: + case OTPGETREGIONINFO: + case OTPLOCK: + case ECCGETLAYOUT: + case ECCGETSTATS: + case MTDFILEMODE: + case BLKPG: + case BLKRRPART: + break; + + /* "dangerous" commands */ + case MEMERASE: + case MEMERASE64: + case MEMWRITEOOB: + case MEMWRITEOOB64: + case MEMWRITE: + if (!(file->f_mode & FMODE_WRITE)) + return -EPERM; + break; + + default: + return -ENOTTY; + } + switch (cmd) { case MEMGETREGIONCOUNT: if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int))) @@ -702,9 +741,6 @@ static int mtdchar_ioctl(struct file *fi { struct erase_info *erase; - if(!(file->f_mode & FMODE_WRITE)) - return -EPERM; - erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL); if (!erase) ret = -ENOMEM; @@ -997,9 +1033,6 @@ static int mtdchar_ioctl(struct file *fi ret = 0; break; } - - default: - ret = -ENOTTY; } return ret; @@ -1043,6 +1076,11 @@ static long mtdchar_compat_ioctl(struct struct mtd_oob_buf32 buf; struct mtd_oob_buf32 __user *buf_user = argp; + if (!(file->f_mode & FMODE_WRITE)) { + ret = -EPERM; + break; + } + if (copy_from_user(&buf, argp, sizeof(buf))) ret = -EFAULT; else